diff --git a/autobuild_mac80211_release/package/kernel/mt76/patches/3003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
new file mode 100644
index 0000000..69b18cf
--- /dev/null
+++ b/autobuild_mac80211_release/package/kernel/mt76/patches/3003-wifi-mt76-mt7915-wed-find-rx-token-by-physical-addre.patch
@@ -0,0 +1,55 @@
+From e4fd59767d875e2293e7f6a32ff7699a9ded7c41 Mon Sep 17 00:00:00 2001
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+Date: Fri, 25 Nov 2022 14:32:35 +0800
+Subject: [PATCH 3003/3012] wifi: mt76: mt7915: wed: find rx token by physical
+ address
+
+The token id in RxDMAD may be incorrect when it is not the last frame due to
+WED HW bug. Lookup correct token id by physical address in sdp0.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+---
+ dma.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/dma.c b/dma.c
+index bf89b532..b2046b43 100644
+--- a/dma.c
++++ b/dma.c
+@@ -403,9 +403,32 @@ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+ 
+ 	if (mt76_queue_is_wed_rx(q)) {
+ 		u32 buf1 = le32_to_cpu(desc->buf1);
++		u32 id, find = 0;
+ 		u32 token = FIELD_GET(MT_DMA_CTL_TOKEN, buf1);
+-		struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
++		struct mt76_txwi_cache *t;
++
++		if (*more) {
++			spin_lock_bh(&dev->rx_token_lock);
++
++			idr_for_each_entry(&dev->rx_token, t, id) {
++				if (t->dma_addr == le32_to_cpu(desc->buf0)) {
++					find = 1;
++					token = id;
++
++					/* Write correct id back to DMA*/
++					u32p_replace_bits(&buf1, id,
++							  MT_DMA_CTL_TOKEN);
++					WRITE_ONCE(desc->buf1, cpu_to_le32(buf1));
++					break;
++				}
++			}
++
++			spin_unlock_bh(&dev->rx_token_lock);
++			if (!find)
++				return NULL;
++		}
+ 
++		t = mt76_rx_token_release(dev, token);
+ 		if (!t)
+ 			return NULL;
+ 
+-- 
+2.39.0
+